CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensitive Data.This issue affects WM Options Import Export: from n/a through <= 1.0.1.
Explanation of Vulnerability in Simple Terms
WM Options Import Export versions 1.0.1 and earlier expose sensitive configuration data without authentication. An attacker can read private settings and options by making direct requests to the plugin. No user interaction or special privileges are required. Update to a version newer than 1.0.1 immediately.
What an attacker can do
Read sensitive plugin configuration and site options without logging in.
Potential impact on your site
Private settings, API keys, or other sensitive options stored via this plugin become readable to anyone on the internet.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
